Identifying MMORPG Bots: A

Traffic Analysis Approach

By Kuan-Ta Chen, Jhih-Wei Jiang, Polly Huang, HaoHua Chu,
Chin-Laung Lei, and Wen-Chin Chen
Presented by Curtis Mirci

Why would anyone use a bot?

 Why are bots a problem?

Whos used a bot?
Macros and Scripting

Main methods used to detect

Human Interaction
Command Timing
Trend of Traffic Burstiness
Magnitude of Traffic Burstiness
Sensitivity to Network Conditions

Human Interaction
Using moderators or GMs to check

Having trusted players tattle

Problems?

Command Timing
Bot programs have a certain timing thanks
to their main loop.
Two tests in here
Multimodality Test
Regularity Test

What are they?

Command Timing
Multimodality
Easy, use the Dip test! (mentioned in other
papers . . . . )

Regularity

Its a bot if the Fullers statistic is significant at 0.01

Trend of Traffic Burstiness

What is Burstiness?
Packet count sent in successive periods

Bots have smoother burstiness

Magnitude of Burstiness
Uses a cross-point to display how smooth
the traffic is
Bot if smaller than
10 seconds
This give a
minimum false +

Reaction to Network Conditions

Humans will slow down if the game does
Bots wont
Human
Bot

So what should we do?

False+

False-

Correct Rate

Timing

<5%

>95%

Burstiness
Trend

<5%

>95%

Burstiness
Magnitude

<5%

~75%

Connection
Reaction

Now that we know . . .

How can we build a better bot?
How can we defend against this better
bot?
Will the cycle ever end?